- The paper systematically reviews recent research to map AI techniques—including LLMs, machine learning, bots, and recommendation systems—to OSS sustainability challenges such as maintenance, security, funding, community health, and abandonment.
- The paper finds that AI can improve bug detection, vulnerability management, onboarding, contributor-retention analysis, and administrative workflows, but warns that inaccurate reviews, bias, energy use, and opaque decisions can create new problems.
- The paper argues that AI should augment rather than replace OSS communities and calls for explainable tools, cross-disciplinary benchmarks, carbon-aware methods, and longitudinal studies of governance and social effects.
This paper presents a systematic literature review examining how artificial intelligence can support the sustainability of open-source software (OSS). Authored by Karim, Lu, and Goggins of the University of Missouri, the review synthesizes interdisciplinary scholarship from the past five years—drawn from Scopus, Web of Science, ACM Digital Library, IEEE Xplore, and arXiv—to map AI applications against five persistent OSS challenges: contributor engagement, funding, code quality and security, community health, and project abandonment (2602.07071).
Motivation and research gaps
The authors frame OSS as critical digital infrastructure suffering from a well-documented "tragedy of the commons": widespread consumption of OSS by a small base of active maintainers. This imbalance produces concrete risks—project abandonment, unpatched vulnerabilities, and inadequate end-of-life procedures—which growing software complexity compounds. The review identifies two gaps motivating its contribution: a synthesizing gap, since prior surveys address either AI in software engineering generally or OSS in isolation without connecting the two to sustainability, and a recency gap, because LLMs' (LLMs) effects on distributed, volunteer-driven communities have not been evaluated within a unified framework.
Methodology
The review follows a PRISMA-style protocol. Searches combined Boolean strings over AI, OSS, and sustainability terms, restricted to scholarly publications from the last five years and written in English. A multi-stage pipeline—title/abstract screening followed by full-text review—excluded non-academic sources, papers treating AI or OSS in isolation, duplicates, and work on general software engineering without OSS implications. Findings were synthesized thematically through iterative coding: extracting core challenges, mapping AI techniques onto those challenges, analyzing algorithms and their practical and ethical implications, and structuring the resulting taxonomy.
The challenge landscape
The paper organizes OSS sustainability threats into six interconnected categories:
- Contributor engagement: volunteer projects struggle to retain contributors and onboard newcomers; understanding motivation and attrition is central.
- Funding and resources: most projects lack sustainable financial models; explored remedies include nonprofits, dual licensing, paid support tiers, and hybrid models.
- Code quality and technical debt: heterogeneous contributor skill levels and inconsistent coding styles degrade long-term maintainability absent strong review processes.
- Security: openness exposes code to malicious actors, and dense dependency webs multiply attack surface.
- Governance and community health: decision-making structures shape quality trajectories; "community smells" signal organizational dysfunction.
- Abandonment: maintainer burnout or competing commitments can terminate even mature, widely used projects.
AI applications for sustainability
Automated maintenance and bug fixing
The review documents three strands. Intelligent bug detection uses machine learning over historical defect data to flag anomalies early and provide real-time developer feedback. Automated patch generation applies Neural Machine Translation trained on buggy/fixed code pairs from OSS repositories—the "translate" formulation—and LLM-based agents that fix diverse bug types; one cited study reports LLMs achieving high success rates on Java bugs, outperforming existing automated program repair models. AI-assisted code review promises efficiency gains, but the review notes a countervailing empirical finding: LLM-based reviewers can lengthen pull request closure times and generate faulty or irrelevant comments. This tension is a notable strength of the review—it resists presenting automation as uniformly beneficial.
Tools such as YOSHI and csDetector apply machine learning to repository trace data, issue trackers, and communication channels, quantifying project vitality and detecting community smells (2602.07071). Predictive modeling can forecast contributor attrition, enabling proactive intervention, while sentiment analysis surfaces conflict and identifies emergent leaders.
Onboarding and mentorship
AI mentors embedded in platforms, task recommendation systems matching newcomers to issues by skill level, and mentor-matching based on community members' proficiency are reviewed alongside chatbot-based guidance. Evidence cited includes findings that newcomers expect AI mentor support in identifying engaging first contributions, and that platform-level communication practices measurably affect sustained participation.
Security and vulnerability management
NLP-based static and dynamic analysis treats source code as text for vulnerability detection, with cited work demonstrating high accuracy on C/C++ code while providing explanations via explainable AI. Predictive risk modeling learns patterns from historical vulnerability data, and automated remediation—including AI-driven patching demonstrated in the OSS-Fuzz context—can expedite fixes for detected weaknesses.
Bots, agents, and green AI
Bots automate issue labeling, triage, and reviewer assignment, relieving maintainers of administrative overhead. Distinctively, the review devotes attention to Green AI: training and inference carry substantial energy costs across the model life cycle, and mitigation strategies include parameter-efficient methods such as LoRA and pruning, energy-efficient hardware co-design (e.g., SuperCode), and carbon-aware computing. The authors argue open-source principles themselves advance responsible AI through community scrutiny of models, data, and shared infrastructure that reduces duplicated computation.
Challenges, limitations, and ethical considerations
The review is candid about constraints. Training data from OSS projects is heterogeneous, noisy, and unevenly available, threatening model robustness and generalizability. Bias in training corpora risks being amplified in triage, recommendation, and moderation decisions affecting globally diverse contributor populations. Trust and transparency require explainable AI decisions; contributors need to interrogate recommendations rather than accept them, and overreliance on plausible but incorrect AI output remains a documented hazard. Misuse risk grows as tooling becomes more capable, and intellectual property and licensing of AI-generated code remain unresolved within OSS frameworks. Finally, integration must preserve the social dynamics and collaborative ethos that constitute OSS's core value—augmentation, not substitution, is the stated design imperative. A structural limitation of the underlying literature, acknowledged by the authors, is the near-absence of longitudinal evidence: most studies measure short-term performance rather than long-term effects on governance, power relations, or project trajectories.
Assessment
The review's principal contribution is taxonomic: it maps AI technique families—LLMs, classical ML, recommendation systems, NLP, bots/agents, Green AI—onto sustainability problem areas, supported by comparative tables detailing strengths and limitations per application area. Its framing of AI as augmentation of human infrastructure, rather than replacement, is consistent with the human-centered literature it synthesizes. The identified open questions are specific: how AI adoption reshapes OSS governance over multi-year horizons; how to quantify environmental footprints of AI-enhanced OSS across full model life cycles; how to build explainable, controllable systems suited to volunteer workflows; and how to mitigate data scarcity and bias in OSS-derived corpora. Cross-disciplinary benchmark datasets, shared evaluation frameworks, and longitudinal study designs are proposed as concrete next steps.
Conclusion
This systematic review consolidates a fragmented literature at the intersection of AI and OSS sustainability, delineating where AI demonstrably assists—bug fixing, vulnerability detection, community analytics, onboarding, and administrative automation—and where evidence remains thin, particularly regarding long-term social and governance effects and ethical deployment in volunteer-driven settings. It serves as a foundational reference for researchers designing AI interventions for OSS and for practitioners weighing adoption against fairness, transparency, and integration costs, while making clear that realizing AI's potential requires sustained empirical attention to the risks it introduces.